US 8935785

Patent Overview — US 8,935,785 B2

Title: IP prioritization and scoring system for DDoS detection and mitigation

Patent number: US 8,935,785 B2

Application number: US 13/243,714 (published as US 2012/0079592 A1)

Inventor: Ramakant Pandrangi

Assignee: Verisign Inc. (original assignee; assignment recorded to Verisign, Inc.)

Key dates (as listed in the source): Priority date 2010-09-24; filing date 2011-09-23; publication date 2015-01-13; legal status listed as Active, with adjusted expiration 2031-12-20. The source notes the legal status and dates are assumptions, not legal conclusions.

Purpose: The disclosure addresses Internet security, specifically detection, handling, and analysis of distributed denial-of-service (DDoS) attacks. It observes that conventional mitigation relies on whitelists, blacklists, and packet inspection, which "does not allow much granularity in setting traffic policies." The described system instead applies thresholds gradually, using more granular information to decide which traffic to filter or allow.

Plain-language scope (from the supplied text): Embodiments gather information about client IP addresses from multiple sources before an attack to build a pre-attack knowledge base, analyze and correlate that information, and compute a variable confidence score for individual IP addresses. Sources may be weighted. Data may include historical and current data, comparisons between current and historically obtained services, and non-IP identifiers such as cookies and fingerprinting. Example sources include Netflow/SFlow information, blacklists of known malicious IP addresses, IP-to-location mapping, and connection counts and times. Threshold values define subsets of confidence-score ranges; traffic from an IP is processed according to where its score falls. The described methods limit network traffic based on confidence scores and thresholds, with a second threshold greater than a first; FIG. 3 illustrates prioritization from drop, to inspect, to rate limit, to queue. Figures 1–7 show normal operation, mitigation strategies, threshold use and adjustment, a system schematic, and a flowchart.

Source: https://patents.google.com/patent/US8935785/en

What the excerpt does not establish: It is a partial excerpt and omits text (including the remainder of FIG. 3 and later description, and the full claims). It does not provide claim language, a complete list of references, prosecution details, or independent verification of dates, status, or assignee accuracy.